Screen Ferry is made by Elysian Edge LLC. This page describes what the apps and the relay service actually do with your information. It describes the software as it is built, not as a category of product generally works.
The short version
We keep the minimum needed to know who you are, which Macs are yours, and which of them talked to which. We do not store the contents of your screen, your keystrokes, or your files. There is no advertising, no analytics product, and nothing on this website that reports back to anyone.
Signing in
You can sign in with Apple, Google, Microsoft, or Amazon. When you do, that provider sends us a small set of facts about you and nothing else:
- A user identifier — a stable id that is meaningful only to that provider and to us.
- Your email address.
- Whether the provider considers that email verified.
- Your display name, where the provider sends one.
Those four items are the whole of it. We do not receive your password, your contacts, your calendar, your files, or a token that would let us act as you anywhere else. Two details worth stating because they are visible in the code: Apple sends the display name only once, during the initial authorisation, so for Apple sign-ins we usually have no name at all; and Microsoft does not assert whether an email is verified, so we record it as unverified rather than assuming.
When you sign in, your browser talks to that provider directly. They will see that request, and their own privacy policy governs it.
What the relay stores
The relay is the service we run that lets your two Macs find each other. It keeps a small database. Here is all of it:
- Your account — an id, your email address, a hashed password if you set one, whether the account is active, and when it was created. Passwords are stored as argon2id hashes, never as passwords.
- Your devices — for each Mac you enrol: a name you chose, whether it acts as host or viewer, its public key, when it was added, and when it was last seen.
- Access tokens — stored as a SHA-256 hash of the token, never the token itself, along with when it was created, when it expires, when it was last used, and the IP address it was created from.
- Pairings — which viewer is allowed to connect to which host, and whether that permission is pending, active, or revoked.
- Sessions — a record that a connection happened: which two devices, when it started, whether it was accepted or declined, when it ended and why, how many bytes were relayed in each direction, and the IP addresses of both ends.
- Audit events — a log of account and device changes: what happened, when, which account or device did it, and the source IP. This log is built so that it never contains payload bytes, keys, tokens, or the network addresses discovered during connection setup.
Notice what is not in that list. There is no record of what was on your screen, what you typed, what you clicked, what applications you ran, or what files you moved. The relay counts bytes; it does not keep them. Forwarded traffic is never written to disk, and the machine running the relay is provisioned with swap turned off so it cannot be written there either.
How connections work, factually
Both Macs make outbound connections to the relay. No inbound ports are opened on either machine. The relay matches the two ends, helps them find a direct network path where the network allows one, and forwards traffic between them when it does not. Session keys are negotiated between your two Macs, and each end verifies the other's registered device key.
We are describing the architecture, not making a security guarantee. A claim about what the relay can and cannot read is one we intend to make only after an independent security review says it in writing. We have not published that review, so we are not making that claim here.
How long we keep it
A job runs once a day and deletes everything past its window. These are the actual periods:
- Deleted accounts — removed 30 days after you delete them.
- Revoked devices and revoked pairings — removed 90 days after revocation.
- Session records — removed 90 days after the session ends.
- Audit events — removed 90 days after the event.
- Expired or revoked tokens — removed 7 days later.
- One-time sign-in challenges — removed after 10 minutes.
Separately, credentials expire on their own: a signed-in session on your account lasts 30 days, a device's own token lasts 24 hours and is renewed automatically, and an idle connection is closed after 10 minutes.
What the apps keep on your Mac
Each app stores its own device identity — the private key that proves that Mac is yours — plus the tokens it uses to reach the relay, and your list of saved connections. On Macs with a Secure Enclave, the device's signing key is generated inside the Enclave and never leaves it. Nothing about your sessions is uploaded from these files, and no secret is ever written to a log.
What this website puts in your browser
Very little, and it is worth being specific, because most sites cannot say this:
- No analytics. No page-view counter, no product analytics, no session recorder, no tag manager.
- No trackers and no advertising.
- No cookie banner, because there is nothing to consent to.
- No third-party requests. Every script, stylesheet, font, and image on this site is served from this site. Your browser does not contact any other company while you read this page.
Two things are stored locally in your browser, both by you and for you: your light-or-dark theme preference, and — once you sign in — your display name and a small copy of your profile picture, so the page can draw it without fetching it from your provider on every visit. No token, no email address, and no account id is stored in your browser. If you are signed in, the session itself is a cookie set by our own server on this domain; the page scripts never read or write it.
Who else sees your information
- The identity provider you choose to sign in with — Apple, Google, Microsoft, or Amazon. Only the one you pick, only at the moment you sign in.
- Our hosting provider — the relay runs on a rented Linux server, so the company that rents it to us necessarily holds the disk it runs on. [NEEDS COUNSEL] — name the hosting provider once the production deployment is fixed. The repository names one only as an example, and this page must not name a vendor we have not committed to.
We do not sell your information, and we do not share it with advertisers or data brokers. [NEEDS COUNSEL] — disclosure to law enforcement or in response to legal process needs a reviewed paragraph; do not write one from a template.
Deleting your account
You can delete your account, and doing so removes your devices, pairings, tokens, and session records along with it. The record is marked deleted immediately and erased entirely within 30 days by the job described above. Write to support@screenferry.com and a person will action it.
Your rights
[NEEDS COUNSEL] — specific rights under GDPR, UK GDPR, the CCPA/CPRA, or any other regime depend on where the company is established, where the relay runs, and who our users are. None of that is settled in this repository, so no jurisdiction-specific rights are claimed here yet. What is true today regardless: you can ask us what we hold about you, and you can have it deleted.
Children
Screen Ferry is not intended for children. [NEEDS COUNSEL] — the minimum age and the accompanying children's-privacy language depend on the jurisdiction decision above.
Changes
If we change how any of this works, we will change this page and update the effective date. [NEEDS COUNSEL] — whether material changes require advance notice, and how much.
Contact
Elysian Edge LLC — support@screenferry.com. [NEEDS COUNSEL] — postal address and the name of a data-protection contact, if one is required.